Summary
[1.1.12-8.0.1]
- removed rhel-Vendor.conf.patch
[1.1.12-8]
- Backport fix for CVE-2026-41651.
- Resolves: #RHEL-170493
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | PackageKit | 0:1.1.12-8.0.1.el8_10 |
| Oracle Linux · 8 | PackageKit-command-not-found | 0:1.1.12-8.0.1.el8_10 |
| Oracle Linux · 8 | PackageKit-cron | 0:1.1.12-8.0.1.el8_10 |
| Oracle Linux · 8 | PackageKit-glib | 0:1.1.12-8.0.1.el8_10 |
| Oracle Linux · 8 | PackageKit-glib-devel | 0:1.1.12-8.0.1.el8_10 |
| Oracle Linux · 8 | PackageKit-gstreamer-plugin | 0:1.1.12-8.0.1.el8_10 |
| Oracle Linux · 8 | PackageKit-gtk3-module | 0:1.1.12-8.0.1.el8_10 |
Vulnerabilities 1
-
High 8.8CVE-2026-41651 Public exploit
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…